{"action":"Upgrade github.com/anycable/anycable to 1.6.15 or later.","affected":[{"fixed":"1.6.15","introduced":"0"}],"component":"github.com/anycable/anycable","cve_ids":["CVE-2026-63405"],"ecosystem":"Go","epss":0.00209,"exploited":false,"fixed_versions":["1.6.15"],"ghsa_id":"GHSA-5p54-whvp-x327","id":"tcs_01M5KEYKR9V17FEHYR6P12F3R5","modified_at":"2026-09-28T17:10:52.635822676Z","published_at":"2026-09-18T17:16:25Z","references":["https://osv.dev/vulnerability/GHSA-5p54-whvp-x327","https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327","https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c","https://github.com/anycable/anycable","https://github.com/anycable/anycable/releases/tag/v1.6.15"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-5p54-whvp-x327","url":"https://osv.dev/vulnerability/GHSA-5p54-whvp-x327"}],"summary":"AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body"}